formbook | 7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e

General

Target

7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
Size

516KB
MD5

18c2161ecb305a851f25366ebeedd693
SHA1

48c4e5b25938b067431d2d43229db647bcac0981
SHA256

7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e
SHA512

3725e39518c2f8f7a3a6dfd12ceee8cf0383dfaaeccfa9f181a2d7cbb9789839a012ffb958ba42eed429e9e01ce9a14f97925b8bc0c1e3a97eff3b2183e65851

Score

10^/10

formbook kzk9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/508-124-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/508-125-0x000000000041EB80-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

Processes:

7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

description	pid	process	target process
PID 4012 set thread context of 508	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

pid	process
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
508	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
508	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

description pid process

Token: SeDebugPrivilege 4012 7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

description	pid	process
Token: SeDebugPrivilege	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

description	pid	process	target process
PID 4012 wrote to memory of 428	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 428	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 428	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 508	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 508	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 508	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 508	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 508	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
PID 4012 wrote to memory of 508	4012	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe	7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe

C:\Users\Admin\AppData\Local\Temp\7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
"C:\Users\Admin\AppData\Local\Temp\7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012

C:\Users\Admin\AppData\Local\Temp\7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
"C:\Users\Admin\AppData\Local\Temp\7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe"
2⤵
PID:428

C:\Users\Admin\AppData\Local\Temp\7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe
"C:\Users\Admin\AppData\Local\Temp\7b5e02a2a7012cbdb1e2588740896860081c0044da0cc697db7839ae8d5d6a8e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/508-125-0x000000000041EB80-mapping.dmp

Download
memory/508-126-0x0000000001710000-0x0000000001A30000-memory.dmp

Filesize
3.1MB

Download
memory/4012-115-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/4012-117-0x0000000005C10000-0x0000000005C11000-memory.dmp

Filesize
4KB

Download
memory/4012-118-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/4012-119-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4012-120-0x0000000003180000-0x0000000003181000-memory.dmp

Filesize
4KB

Download
memory/4012-121-0x00000000063F0000-0x00000000063F7000-memory.dmp

Filesize
28KB

Download
memory/4012-122-0x0000000009320000-0x0000000009321000-memory.dmp

Filesize
4KB

Download
memory/4012-123-0x00000000092D0000-0x000000000931F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads